On Transfer of Adversarial Robustness from Pretraining to Downstream Tasks

This illustrates the dependence of the classifier on the representation's robustness, i.e., the predictor can only be robust if